CVE-2026-76353

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.2 Splunk Enterprise versions prior to 10.2.6 Splunk Enterprise versions prior to 10.0.9 Splunk Enterprise versions prior to 9.4.14

Description A user without admin or power roles can delete arbitrary files accessible to the software on a cluster manager by submitting a crafted knowledge bundle delta. This occurs because the knowledge bundle delta processing fails to restrict removal paths to the staging directory and the endpoint does not enforce the required authorization boundary, potentially compromising system integrity and disrupting service.

Recommendations Update to version 10.4.2 or later. Update to version 10.2.6 or later. Update to version 10.0.9 or later. Update to version 9.4.14 or later.